Python pip

ID

pip

Home page

https://pip.pypa.io

Version requirement

>= 26.1

Cooldown

✓

Platforms

🅱️ BSD · 🐧 Linux · 🍎 macOS · ⨂ Unix · 🪟 Windows

Operations

installed · outdated · install · upgrade · upgrade_all · remove · cleanup · doctor

purl types

pkg:pip · pkg:pypi

CLI names (lookup order)

python3 · python

Every call

python3 -m pip --no-color <command>

Issues and PRs

📦 manager: pypi-based

Source

meta_package_manager/managers/pip.py

The pip package installer for Python, driven as a module (python -m pip) rather than through the pip executable.

Calling the module through the interpreter lets pip upgrade itself, an advantage on Windows in particular: see why you should use python -m pip.

Installed and outdated packages are read from pip’s list --format=json output. The outdated query adds --not-required to report only top-level packages, since upgrading a transitive dependency can break its parent’s version constraints (#1214). There is no search: PyPI disabled its server-side search API in 2020 under unmanageable load, so pip search no longer works (see pypa/pip#5216).

Note

All operations target the default pip scope (system site-packages, or the active virtualenv). Per-scope targeting (system vs user vs venv) and multi-binary discovery (multiple pythons via pyenv) are tracked in #1725.

Note

Interpreter discovery probes the running Python first, so an mpm installed inside a virtualenv manages that virtualenv, then the Python(s) on PATH. Two kinds are skipped so the manager only targets a scope the user can install into: mpm’s own distributor-managed bundle (Homebrew stages it under a Cellar prefix) and any externally-managed, non-virtualenv interpreter that PEP 668 forbids pip install into. When every candidate is skipped, the manager reports as unavailable.

Note

Installs, upgrades and removals are marked privileged, so a global install can escalate with --sudo, but escalation is off by default. The supply-chain cooldown needs pip 26.1, the first release to honor --uploaded-prior-to; older pip silently ignores the release-age gate.

What mpm adds to pip

Through mpm, pip gains a one-command upgrade --all that refreshes every outdated package in a single run.

Bigger still, mpm reaches across every manager at once: mpm installed and mpm outdated cover pip alongside pipx, uv and any other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your pip commands, in mpm

You already know pip: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With pip	With mpm
List what’s installed	python list --format=json --verbose --quiet	mpm --pip installed
List outdated packages	python list --format=json --outdated > --not-required --verbose --quiet	mpm --pip outdated
Install a package	python install arrow	mpm install pkg:pip/arrow
Upgrade one package	python install --upgrade six	mpm --pip upgrade six
Upgrade everything	—	mpm --pip upgrade --all
Remove a package	python uninstall --yes arrow	mpm remove pkg:pip/arrow
Clear caches	python cache purge	mpm --pip cleanup --cache
Run health checks	python check	mpm --pip doctor

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations

Operation	Supported	Notes
installed	✓
outdated	✓
orphans
search
install	✓
upgrade	✓
upgrade_all	✓	backfilled by mpm
remove	✓
sync
cleanup	✓
doctor	✓

Selecting and configuring pip

Deselect pip for a single run with --no-pip, or persist the choice in your configuration:

[mpm]
pip = false

The arguments and environment variables listed in the box atop this page are forced on every pip call, so runs stay quiet, non-interactive and reproducible: the defaults you would set in CI anyway.

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.pip]
timeout = 900

mpm config-template pip prints every overridable attribute as a ready-to-paste block.

Recipes

A few jobs you would otherwise script around pip, one mpm command each:

• Snapshot and clone a machine: mpm --pip dump pip.toml, then mpm restore pip.toml on the next one.

• Export a compliance SBOM: mpm --pip sbom (CycloneDX by default, --spdx for SPDX).

• Gate CI on health: mpm --pip doctor relays Python pip’s own diagnosis and exits non-zero on trouble.

Privilege escalation

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

See privilege escalation for the full policy.

Cooldown

mpm natively enforces its release-age cooldown on Python pip, injecting the PIP_UPLOADED_PRIOR_TO environment variable on every call. Point it at a window (mpm --cooldown 7 --pip upgrade --all) to skip anything published in the last 7 days: a guard against a compromised or yanked fresh release landing before anyone notices.

• Status: ✅ Enforced (pip ≥ 26.1)

• Mechanism: --uploaded-prior-to env PIP_UPLOADED_PRIOR_TO

• Reference: pypa/pip#13674

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

• Registry: PyPI (pkg:pypi)

• Retraction: Yank (PEP 592): the file stays downloadable, but an installer “MUST ignore yanked releases, if the selection constraints can be satisfied with a non-yanked version”

• Publish date: ✅ upload_time_iso_8601, plus a per-file yanked flag (JSON API)

Version probe

The version is probed by running:

$ python3 -m pip --no-color --version
pip 2.0.2 from /usr/local/lib/python/site-packages/pip (python 3.7)

and extracted with:

r"pip\s+(?P<version>\S+)"

Reference traces

Raw native outputs captured in the manager source: the reference mpm’s parsers were written against. If you know Python pip well and a transcript below looks wrong, or a newer release changed its output format, report it.

$ python -m pip --no-color list --format=json --verbose --quiet
[
 {
    "version": "1.3",
    "name": "backports.functools-lru-cache",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": "pip"
  },
  {
    "version": "0.9999999",
    "name": "html5lib",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": "pip"
  },
  {
    "name": "setuptools",
    "version": "46.0.0",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": ""
  },
  {
    "version": "2.8",
    "name": "Jinja2",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": ""
  }
]

$ python -m pip --no-color list --format=json --outdated         > --not-required --verbose --quiet
[
  {
    "latest_filetype": "wheel",
    "version": "0.7.9",
    "name": "alabaster",
    "latest_version": "0.7.10",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": "pip"
  },
  {
    "latest_filetype": "wheel",
    "version": "0.9999999",
    "name": "html5lib",
    "latest_version": "0.999999999",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": "pip"
   },
  {
    "latest_filetype": "wheel",
    "version": "2.8",
    "name": "Jinja2",
    "latest_version": "2.9.5",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": "pip"
   },
  {
    "latest_filetype": "wheel",
    "version": "0.5.3",
    "name": "mccabe",
    "latest_version": "0.6.1",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": "pip"
   },
  {
    "latest_filetype": "wheel",
    "version": "2.2.0",
    "name": "pycodestyle",
    "latest_version": "2.3.1",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": "pip"
   },
  {
    "latest_filetype": "wheel",
    "version": "2.1.3",
    "name": "Pygments",
    "latest_version": "2.2.0",
    "location": "/usr/local/lib/python3.7/site-packages",
    "installer": ""
   }
]

Feed any of these through mpm and the raw output becomes one uniform table, the same shape for every manager: filter it, project columns, or export it (mpm --pip installed --output json, or csv, toml, yaml), each package carrying a purl and a version comparable across managers.

Changelog

• 7.1.0 (2026-07-07)

  • Only target a Python the user can actually install into: mpm’s own bundled virtualenv and externally-managed interpreters (PEP 668) are skipped, so distro-managed packages no longer surface as bogus outdated pip upgrades. Supersedes the dependency-tree filter from #1767.

  • Probe the Python interpreter version under the short read-only timeout instead of the long state-changing default.

• 6.4.0 (2026-04-27)

  • Add cleanup operation.

  • Filter mpm’s own dependency tree from outdated results to fix false positives in Homebrew-installed environments. Closes #1767.

• 6.3.0 (2026-04-09)

  • Only report top-level packages as outdated, skipping transitive dependencies. Closes #1214.

  • Remove --user flag from upgrade command so upgrades target the same scope as list and outdated.

  • Prepend the current Python executable to the list of candidates when searching for pip binaries, so the active environment is always checked first.

• 5.11.7 (2023-02-20)

  • Print Python’s own version in debug logs before checking for Pip’s version.

• 5.4.0 (2022-06-29)

  • Do not wait for user confirmation on remove operation.

• 5.2.0 (2022-06-16)

  • Add remove operation.

• 4.1.0 (2021-05-01)

  • Fix search of python3 binary on macOS. Closes #247.

• 3.6.0 (2021-01-03)

  • pip search has been disabled by maintainers because of server-side high-load.

• 3.2.0 (2020-05-31)

  • Remove pip2/pip3 distinctions, use system’s python and call pip module.

• 3.0.0 (2020-03-25)

  • Collect installer metadata on listing.

  • Bump minimal requirement of pip to 10.0.*.

• 2.9.0 (2020-03-18)

  • Force Python pip upgrade to user-installed packages. Refs #58.

• 2.6.0 (2017-09-10)

  • Use pip 9.0 JSON output. Closes #18.

  • Bump minimal requirement of pip to 9.0.*.

• 2.2.0 (2016-12-25)

  • Allow usage of pip2 and pip3 managers on Linux.

• 1.7.0 (2016-08-16)

  • New workaround for full pip upgrade command.

• 1.6.0 (2016-08-10)

  • Work around the lacks of full pip upgrade command.

• 1.2.0 (2016-07-08)

  • Add support for both pip2 and pip3, Node’s npm, Atom’s apm, Ruby’s gem.

• 1.1.0 (2016-07-07)

  • Add support for Python’s pip.